Adobe ColdFusion input-validation failure — CVSS 9.6
Input-validation failure in Adobe ColdFusion enables unauthenticated remote code execution. Patched in ColdFusion 2025 Update 11 and ColdFusion 2023 Update 22.
- Vendor
- Adobe
- Product
- ColdFusion 2023, ColdFusion 2025
- CVSS
- 9.6
- EPSS (exploit probability)
- 0.5%
- Status
- patched
- Published
Is CVE-2026-48284 being exploited?
Not on any exploited-vulnerability catalog we track. CVE-2026-48284 was not on the CISA, ENISA or CIRCL exploited catalogs as of our 2026-10-19 snapshot. That can change quickly; check the write-up below for the latest reporting.
FIRST's EPSS model puts the probability of exploitation activity in the next 30 days at 0.5% (scored October 14, 2026).
- CISA KEV[ — ]
- ENISA EUVD (exploited)[ — ]
- CIRCL KEV[ — ]
Catalog snapshot 2026-10-19. Full cross-catalog view: /kev-comparison
An input-validation failure in Adobe ColdFusion allows a remote unauthenticated attacker to execute arbitrary code. Part of Adobe’s July 2026 batch that included eight ColdFusion critical CVEs; patched simultaneously in the same update release.
Apply ColdFusion 2025 Update 11 or ColdFusion 2023 Update 22. Internet-exposed ColdFusion instances should be treated as a priority-zero patch target — the platform has appeared repeatedly in CISA’s KEV catalog following advisory releases.
Source: NVD · Adobe Security Bulletin
Other Adobe ColdFusion CVEs we track
| CVE / Vulnerability | Severity | CVSS | EPSS | Added to KEV |
|---|---|---|---|---|
| CVE-2026-48325 Adobe ColdFusion missing authentication — CVSS 9.3write-up | [ CRITICAL ] | 9.3 | 0.6% | — |
| CVE-2026-48322 Adobe ColdFusion code injection — CVSS 9.6write-up | [ CRITICAL ] | 9.6 | 1.2% | — |
| CVE-2026-48321 Adobe ColdFusion authorization bypass — CVSS 9.3write-up | [ CRITICAL ] | 9.3 | 0.4% | — |
| CVE-2026-48319 Adobe ColdFusion path traversal — CVSS 9.1write-up | [ CRITICAL ] | 9.1 | 1.4% | — |
| CVE-2026-48318 Adobe ColdFusion path traversalwrite-up | [ CRITICAL ] | 9.9 | 1.1% | — |
| CVE-2026-48282 Adobe ColdFusion path-traversal to arbitrary code executionwrite-up | [ CRITICAL ] | 10.0 | 42.4% | |
| CVE-2017-3066 Adobe ColdFusion Deserialization Vulnerability | [ CRITICAL ] | 9.8 | 90.6% | |
| CVE-2024-20767 Adobe ColdFusion Improper Access Control Vulnerability | [ HIGH ] | 7.4 | 98.5% |
